Probabilistic Programming for Malware Analysis

TL;DR

This paper introduces a probabilistic programming approach to malware lineage analysis, enabling joint inference of malware family relationships and creation times despite data volume and obfuscation challenges.

Contribution

It presents a novel probabilistic model and programming solution specifically designed for malware lineage inference, addressing key challenges in cyber-defense.

Findings

Effective joint inference of malware lineage and creation times

Handles obfuscation techniques in malware data

Provides a probabilistic framework for malware analysis

Abstract

Constructing lineages of malware is an important cyber-defense task. Performing this task is difficult, however, due to the amount of malware data and obfuscation techniques by the authors. In this work, we formulate the lineage task as a probabilistic model, and use a novel probabilistic programming solution to jointly infer the lineage and creation times of families of malware.